security: production hardening (seeding, CORS/HSTS, CSP, password policy, HttpOnly refresh cookie, dependabot) - #113

Merged

Akash29g merged 11 commits into

mainfrom

harden/prod-security

Jul 22, 2026

Commits on Jul 21, 2026

security: seed catalogs in all envs, gate demo data + startup migration to Development
Akash29g
committed
965ba50

Commits on Jul 22, 2026

security: lock CORS to prod domain, enforce HSTS + HTTPS redirect in production
Akash29g
committed
ec4d5d4
security: add restrictive CSP to API responses (nginx SPA CSP tracked separately)
Akash29g
committed
c51d8b8
security: enforce password complexity + HaveIBeenPwned breach check on password changes
Akash29g
committed
2b565b3
chore(ci): add github-actions ecosystem to Dependabot
Akash29g
committed
3531009
security: add IPasswordPolicy + PasswordPolicy (missed by -am in the #6 commit)
Akash29g
committed
0fcca69
security: shorten access-token TTL and move refresh token to HttpOnly Secure cookie
Akash29g
committed
ed08cb7
test(web): update auth.service specs for HttpOnly refresh cookie
Akash29g
committed
b2aa1cc
security(web): add restrictive CSP header to nginx SPA responses
Akash29g
committed
002682f
dotnet format
Akash29g
committed
4090134
chore(web): prettier format auth files + npm audit fix (clear high-severity fast-uri)
Akash29g
committed
5ba7448